Question

A financial services organization uses Microsoft 365 E5 and has enabled Microsoft Defender for Cloud Apps. Security discovers that employees are uploading customer data to numerous unsanctioned SaaS applications, and that several OAuth-connected third-party apps have been granted broad Microsoft Graph permissions (such as Mail.ReadWrite and Files.ReadWrite.All) without IT review. The security architect must design a solution that (1) surfaces and blocks risky cloud app usage discovered from network traffic, and (2) continuously monitors and can automatically revoke over-privileged or malicious OAuth app grants against Microsoft 365. Which combination of Defender for Cloud Apps capabilities should the architect implement?

Accepted Answer

Use Cloud Discovery with app tagging and unsanctioned-app blocking for risky SaaS usage, and use App governance (OAuth app policies) to detect and revoke over-privileged or malicious OAuth grants.

Answer

Deploy only Conditional Access App Control (reverse proxy) session policies to inspect all traffic, relying on session controls to catch both shadow IT and OAuth app risks.

Answer

Enable Cloud Discovery for both problems, using continuous log upload to identify shadow SaaS and to enumerate and disable consented OAuth applications.

Answer

Configure file policies with built-in DLP in Defender for Cloud Apps to scan uploaded content, and use anomaly detection policies alone to remediate OAuth app grants.